# openssl-encrypt (PyPI) vulnerabilities

Source: https://junglewise.ai/threats/technologies/pypi-openssl-encrypt  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour.  
Data: https://junglewise.ai/threats/technologies/pypi-openssl-encrypt.json  
License: CC BY 4.0 with a link back

Junglewise Threat Intelligence has tracked 60 vulnerabilities in openssl-encrypt (PyPI): 0 in the last 7 days and 60 in the last 90 days, 9 of them critical and 0 exploited in the wild. The most recent, CVE-2026-81721, was published on 27 August 2026. Nothing was published in the last eight weeks.

## Counts

- Last 7 days: 0
- Last 30 days: 0
- Last 90 days: 60
- All time: 60 (9 critical, 0 exploited in the wild)

## About openssl-encrypt (PyPI)

Python library providing OpenSSL-based encryption and decryption functionality for data security.

## Latest openssl-encrypt (PyPI) vulnerabilities

- [CVE-2026-81721: openssl_encrypt KDF cost parameter validation bypass](https://junglewise.ai/threats/cve-2026-81721-openssl-encrypt-kdf-cost-parameter-validation-bypass) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81720: openssl_encrypt memory exhaustion in identity file protection block](https://junglewise.ai/threats/cve-2026-81720-openssl-encrypt-memory-exhaustion-in-identity-file-protection) (medium, CVSS 6.2, published 27 Aug 2026)
- [CVE-2026-81719: openssl_encrypt arbitrary code execution via plugin signature bypass](https://junglewise.ai/threats/cve-2026-81719-openssl-encrypt-arbitrary-code-execution-via-plugin-signature) (high, CVSS 7.8, published 27 Aug 2026)
- [CVE-2026-81717: openssl_encrypt USB drive integrity bypass with fixed KDF salt](https://junglewise.ai/threats/cve-2026-81717-openssl-encrypt-usb-drive-integrity-bypass-with-fixed-kdf-salt) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81716: openssl-encrypt path traversal in PluginSandbox](https://junglewise.ai/threats/cve-2026-81716-openssl-encrypt-path-traversal-in-pluginsandbox) (medium, CVSS 5.2, published 27 Aug 2026)
- [CVE-2026-81715: openssl-encrypt credential exposure in debug output](https://junglewise.ai/threats/cve-2026-81715-openssl-encrypt-credential-exposure-in-debug-output) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81714: openssl-encrypt cryptographic signature verification bypass](https://junglewise.ai/threats/cve-2026-81714-openssl-encrypt-cryptographic-signature-verification-bypass) (high, CVSS 7, published 27 Aug 2026)
- [CVE-2026-81706: openssl_encrypt namespace collision in IdentityStore allowing key substitution](https://junglewise.ai/threats/cve-2026-81706-openssl-encrypt-namespace-collision-in-identitystore-allowing-key) (medium, CVSS 6.8, published 27 Aug 2026)
- [CVE-2026-81705: openssl-encrypt sensitive information in debug logs](https://junglewise.ai/threats/cve-2026-81705-openssl-encrypt-sensitive-information-in-debug-logs) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81704: openssl_encrypt weak key derivation in D-Bus EncryptFile handler](https://junglewise.ai/threats/cve-2026-81704-openssl-encrypt-weak-key-derivation-in-d-bus-encryptfile-handler) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81703: openssl_encrypt authentication bypass in post-quantum key validation](https://junglewise.ai/threats/cve-2026-81703-openssl-encrypt-authentication-bypass-in-post-quantum-key) (medium, CVSS 5.5, published 27 Aug 2026)
- [CVE-2026-81702: openssl_encrypt key substitution in identity loading](https://junglewise.ai/threats/cve-2026-81702-openssl-encrypt-key-substitution-in-identity-loading) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81701: openssl_encrypt signature verification bypass via denylist](https://junglewise.ai/threats/cve-2026-81701-openssl-encrypt-signature-verification-bypass-via-denylist) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81700: openssl_encrypt GPG signature verification bypass in gpg_runner](https://junglewise.ai/threats/cve-2026-81700-openssl-encrypt-gpg-signature-verification-bypass-in-gpg-runner) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81699: openssl_encrypt unbounded KDF cost denial of service](https://junglewise.ai/threats/cve-2026-81699-openssl-encrypt-unbounded-kdf-cost-denial-of-service) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81698: openssl_encrypt shell injection in info command](https://junglewise.ai/threats/cve-2026-81698-openssl-encrypt-shell-injection-in-info-command) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81696: openssl_encrypt terminal injection in info command](https://junglewise.ai/threats/cve-2026-81696-openssl-encrypt-terminal-injection-in-info-command) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81695: openssl_encrypt terminal injection in decrypt auto-detection](https://junglewise.ai/threats/cve-2026-81695-openssl-encrypt-terminal-injection-in-decrypt-auto-detection) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81694: openssl-encrypt output injection via unsanitized filenames](https://junglewise.ai/threats/cve-2026-81694-openssl-encrypt-output-injection-via-unsanitized-filenames) (medium, CVSS 4, published 27 Aug 2026)
- [CVE-2026-81693: openssl_encrypt unbounded memory allocation in QR JSON parsing](https://junglewise.ai/threats/cve-2026-81693-openssl-encrypt-unbounded-memory-allocation-in-qr-json-parsing) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81691: openssl_encrypt unvalidated server URL in login and register_with_email](https://junglewise.ai/threats/cve-2026-81691-openssl-encrypt-unvalidated-server-url-in-login-and-register-with) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81690: openssl-encrypt symlink-following in verify-usb](https://junglewise.ai/threats/cve-2026-81690-openssl-encrypt-symlink-following-in-verify-usb) (high, CVSS 7.3, published 27 Aug 2026)
- [CVE-2026-81689: openssl_encrypt weak password key derivation in pepper wrap](https://junglewise.ai/threats/cve-2026-81689-openssl-encrypt-weak-password-key-derivation-in-pepper-wrap) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81688: openssl_encrypt plaintext confirmation oracle via unkeyed SHA-256](https://junglewise.ai/threats/cve-2026-81688-openssl-encrypt-plaintext-confirmation-oracle-via-unkeyed-sha-256) (high, CVSS 7.5, published 27 Aug 2026)
- [CVE-2026-81686: openssl_encrypt D-Bus Properties.Set authorization bypass](https://junglewise.ai/threats/cve-2026-81686-openssl-encrypt-d-bus-properties-set-authorization-bypass) (medium, CVSS 6.2, published 27 Aug 2026)

## Most severe openssl-encrypt (PyPI) vulnerabilities

- [CVE-2026-74878: openssl-encrypt: TOTP rate limiter is in-memory only , not shared across workers, lost on restart](https://junglewise.ai/threats/cve-2026-74878-openssl-encrypt-totp-rate-limiter-is-in-memory-only-not-shared) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-74886: openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks…](https://junglewise.ai/threats/cve-2026-74886-pysec-2026-3763-openssl-encrypt-versions-before-1-4-0-contain-a) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-74872: openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification](https://junglewise.ai/threats/cve-2026-74872-openssl-encrypt-dynamic-so-loading-for-whirlpool-uses-broad-glob) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-74880: openssl-encrypt accepts refresh tokens as URL query parameters causing token leakage](https://junglewise.ai/threats/cve-2026-74880-openssl-encrypt-accepts-refresh-tokens-as-url-query-parameters) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-81701: openssl_encrypt signature verification bypass via denylist](https://junglewise.ai/threats/cve-2026-81701-openssl-encrypt-signature-verification-bypass-via-denylist) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-81700: openssl_encrypt GPG signature verification bypass in gpg_runner](https://junglewise.ai/threats/cve-2026-81700-openssl-encrypt-gpg-signature-verification-bypass-in-gpg-runner) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-74876: openssl-encrypt's unverified key bundle from_dict() + to_identity() path allows encryption to attacker keys](https://junglewise.ai/threats/cve-2026-74876-openssl-encrypt-s-unverified-key-bundle-from-dict-to-identity) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-74875: openssl-encrypt silently skips schema validation when jsonschema library is not installed](https://junglewise.ai/threats/cve-2026-74875-openssl-encrypt-silently-skips-schema-validation-when-jsonschema) (critical, CVSS 9.8, published 17 Aug 2026)
- [CVE-2026-81702: openssl_encrypt key substitution in identity loading](https://junglewise.ai/threats/cve-2026-81702-openssl-encrypt-key-substitution-in-identity-loading) (critical, CVSS 9.8, published 27 Aug 2026)
- [CVE-2026-74877: openssl-encrypt has no owner verification on key revocation , any client can revoke any key](https://junglewise.ai/threats/cve-2026-74877-openssl-encrypt-has-no-owner-verification-on-key-revocation-any) (high, CVSS 8.8, published 17 Aug 2026)

## Vulnerabilities per week

Nothing was published in the last eight weeks.

| Week of | Vulns | Critical | Exploited |
| --- | --- | --- | --- |
| 17 Aug 2026 | 30 | 6 | 0 |
| 24 Aug 2026 | 30 | 3 | 0 |
| 31 Aug 2026 | 0 | 0 | 0 |
| 7 Sep 2026 | 0 | 0 | 0 |
| 14 Sep 2026 | 0 | 0 | 0 |
| 21 Sep 2026 | 0 | 0 | 0 |
| 28 Sep 2026 | 0 | 0 | 0 |
| 5 Oct 2026 | 0 | 0 | 0 |
| 12 Oct 2026 | 0 | 0 | 0 |
| 19 Oct 2026 | 0 | 0 | 0 |
| 26 Oct 2026 | 0 | 0 | 0 |
| 2 Nov 2026 | 0 | 0 | 0 |
| 9 Nov 2026 | 0 | 0 | 0 |

## Other PyPI technologies

- [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities
- [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities
- [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities
- [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities
- [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities
- [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities
- [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities
- [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities
- [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities
- [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities
- [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities
- [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities

## Sources

NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "openssl-encrypt (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pypi-openssl-encrypt, 13 November 2026.